A law firm, an accountant or a technical consultancy handles personal data about clients, employees and counterparties every day: identity documents, tax data, litigation files, sometimes health data. The GDPR does not ask an office to become a bank, but it does ask it to adopt appropriate security measures and to know how to react when something goes wrong. Let’s look at what this means in practice.
What does Article 32 of the GDPR require?
Article 32 of the GDPR requires the data controller and the data processor to implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk. When assessing what is appropriate, account is taken of the state of the art, the costs, the nature of the data and the risks to people.
The article lists, “inter alia”, these measures:
| What Art. 32 asks for | Practical examples in an office |
|---|---|
| Pseudonymisation and encryption of data | Encrypted laptop drives, encrypted backups, remote connections via VPN |
| Confidentiality, integrity, availability and resilience of systems | Firewall, personal accounts, two-factor authentication, updates |
| Ability to restore data in a timely manner after an incident | Disconnected backup and a tested restore procedure |
| A process for regularly testing and evaluating the effectiveness of the measures | Periodic checks, restore tests, security reports |
The key point is the principle of accountability: it is not enough to do things, you must be able to demonstrate that you have done them.
What is a data breach?
A data breach, or personal data breach, is a security incident leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.
Concrete examples:
- ransomware encrypts the client archive (loss of availability);
- an email containing a client’s tax return is sent to the wrong person (loss of confidentiality);
- an unencrypted laptop is stolen from a car;
- an email account is compromised and used to read correspondence;
- an employee accidentally deletes an archive that has no backup.
You do not need a “hacker” for there to be a data breach: human error counts too.
Data breaches: when must they be notified to the Garante within 72 hours?
Article 33 requires the controller to notify the breach to the Italian Data Protection Authority (Garante per la protezione dei dati personali) without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of people.
Article 34 adds that, if the risk is high, the data subjects themselves must also be informed, in plain language.
In short:
| Situation | What to do |
|---|---|
| Breach with an unlikely risk | Document it in the internal register |
| Breach with a risk to people | Notify the Garante within 72 hours + register |
| Breach with a high risk | Notify the Garante + inform the data subjects + register |
Notification is made through the online procedure provided by the Garante on its website. If not all the information is available straight away, it can be provided in phases.
Why are the 72 hours a problem for an office?
The 72 hours run from the moment the office becomes aware of the breach. The real risk is not missing the deadline, but not noticing the incident at all, or noticing it weeks later.
An office that relies only on the internet provider’s router often has no way of knowing whether a computer has sent data outside or whether someone has tried to log in remotely. That is why, alongside prevention, the ability to detect matters: knowing what is happening on the network and keeping a log that makes it possible to reconstruct events. We cover this in the article on why the router is not enough.
The breach register: do not forget it
Article 33, paragraph 5, requires you to document any breach, including those you do not notify: what happened, what its effects were and what remedial action was taken. The register enables the Garante to verify compliance with the rules, and helps the office learn from its mistakes.
The minimum measures to start with
This list is not exhaustive and should be adapted with your data protection adviser:
- Encrypted, disconnected and tested backup. → The 3-2-1 rule
- Two-factor authentication on email, cloud services and practice-management software. → Passwords, MFA and passkeys
- A firewall with monitoring and an event log.
- Encryption of laptops and any devices that leave the office.
- Personal accounts and minimum permissions: everyone sees only what they need.
- Automatic updates.
- Staff training and written instructions.
- Rules on the use of AI: do not enter client data into unauthorised services. → Generative AI in the office
- An incident procedure, with names and phone numbers. → Cyberattack: what to do
Be careful about monitoring employees
Tools that observe network traffic can, in theory, reveal information about employees’ activity. In Italy this issue involves the Workers’ Statute (Statuto dei lavoratori, Article 4, on remote monitoring of employees) as well as the GDPR. A good security system should therefore collect only the data that is necessary, keep it for a limited time and be accompanied by a clear privacy notice for staff. This is something to assess with your employment adviser or lawyer.
How Strega Defence helps
Strega Defence does not make an office “compliant”: no product can do that. It does, however, help you carry out and demonstrate some of the things the GDPR asks for: it protects the network by closing whatever is not needed, notices relevant events and reports them in plain language, and keeps a Log of who did what and when, which forms the basis of a periodic report you can show to clients, advisers and authorities. Discover Strega Defence.
If your office works for companies subject to the NIS2 Directive, also read what NIS2 changes for suppliers.
This article is for general information only and does not constitute legal advice. For specific cases, consult your data protection adviser or DPO.
Frequently asked questions
Does the GDPR require you to have a firewall?
The GDPR does not name specific products: it asks for technical and organisational measures appropriate to the risk. For an office handling confidential client data, however, a properly configured and monitored firewall is one of the measures that normally form part of the state of the art.
How soon must a data breach be notified?
Without undue delay and, where feasible, within 72 hours of the controller becoming aware of it, unless the breach is unlikely to result in a risk to people. If you notify after 72 hours, you must explain the reasons for the delay.
Is an email sent to the wrong recipient a data breach?
Yes, if it contains personal data: it is an unauthorised disclosure. You need to assess the risk to the people involved to decide whether to notify the Garante, and in any case record it in the breach register.
Who must notify the data breach: the office or the IT supplier?
Notifying the Garante is the responsibility of the data controller, which is normally the office. The supplier processing data on the office’s behalf, as data processor, must inform the controller without undue delay as soon as it becomes aware of the breach.
What penalties does an office face if it does not adopt appropriate measures?
For breaches of the security and notification obligations, the GDPR provides for administrative fines of up to 10 million euros or 2% of total worldwide annual turnover, whichever is higher. On top of that come reputational damage and possible claims for compensation.
Is the breach register mandatory even if nothing has happened?
The GDPR requires you to document every breach that occurs. If none have occurred, the register stays empty, but it is good practice to set it up, together with the incident-handling procedure, so that you are ready.
Sources and further reading
- Regulation (EU) 2016/679 (GDPR), official text — EUR-Lex. Articles 32, 33, 34 and 83.
- Data breach: notifica delle violazioni al Garante (in Italian) — Italian Data Protection Authority (Garante per la protezione dei dati personali). How to notify breaches to the Garante.
- Cybersecurity: temi e consigli (in Italian) — Garante privacy. Topics and advice on cybersecurity.
- Accendiamo la cybersicurezza – consigli per le PMI (in Italian) — ACN, the Italian National Cybersecurity Agency (Agenzia per la Cybersicurezza Nazionale). Advice for small and medium-sized businesses.
Written by Ing. Sergio Florio, founder of Strega Byte, an engineer with over twenty years of experience across research, development and business. Article updated on 11 October 2026.
